threshold/Dockerfile

# Copyright IBM Corp. 2020, 2026
# SPDX-License-Identifier: BUSL-1.1

# This Dockerfile contains multiple targets.
# Use 'docker build --target=<name> .' to build one.
# e.g. `docker build --target=dev .`
#
# All non-dev targets have a VERSION argument that must be provided 
# via --build-arg=VERSION=<version> when building. 
# e.g. --build-arg=0.7.4
#
# `default` is the production docker image which cannot be built locally. 
# For local dev and testing purposes, please build and use the `dev` docker image.


# Development docker image (built from the locally built ./bin/threshold)
FROM alpine:3.21 as dev

RUN set -eux && \
    addgroup threshold && \
    adduser -s /bin/sh -S -G threshold threshold && \
    apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables

ADD bin/threshold /bin/threshold
RUN setcap cap_ipc_lock=+ep /bin/threshold

RUN mkdir /threshold/
ADD .release/docker/config.hcl /threshold/config.hcl
RUN chown -R threshold:threshold /threshold/
RUN chmod -R 640 /threshold/*

# Legacy HashiCorp Boundary compatibility: /boundary -> /threshold and a
# "boundary" command alias (prints a deprecation notice on stderr).
RUN mkdir -p /usr/share/threshold && \
    cp /threshold/config.hcl /usr/share/threshold/config.hcl.default && \
    ln -s /threshold /boundary && \
    ln -s threshold /bin/boundary

EXPOSE 9200 9201 9202
VOLUME /threshold/

LABEL org.opencontainers.image.licenses="BUSL-1.1"

COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
COPY bin/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt

USER threshold
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server", "-config", "/threshold/config.hcl"]


# Production docker image
# Remember, this cannot be built locally
FROM alpine:3.21 as default

ARG BIN_NAME
# NAME is the name of the software (and of the user/group created in the image);
# PRODUCT_VERSION is the version. Example: NAME=threshold PRODUCT_VERSION=1.2.3.
ARG NAME=threshold
ARG PRODUCT_VERSION
# TARGETARCH and TARGETOS are set automatically when --platform is provided.
ARG TARGETOS TARGETARCH

LABEL name="Threshold" \
      vendor="Threshold (fork of HashiCorp Boundary CE)" \
      version=$PRODUCT_VERSION \
      release=$PRODUCT_VERSION \
      summary="Threshold provides simple and secure access to hosts and services" \
      description="The Threshold Docker image is designed to enable practitioners to run Threshold, a community fork of HashiCorp Boundary Community Edition, in server mode on a container scheduler. Not affiliated with or endorsed by HashiCorp or IBM." \
      org.opencontainers.image.licenses="BUSL-1.1"

# Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
ENV NAME=$NAME
ENV VERSION=$PRODUCT_VERSION

# Create a non-root user to run the software.
RUN addgroup ${NAME} && adduser -s /bin/sh -S -G ${NAME} ${NAME}

RUN apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables

COPY .release/docker/config.hcl /threshold/config.hcl

COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /bin/
COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
RUN setcap cap_ipc_lock=+ep /bin/$BIN_NAME

RUN chown -R ${NAME}:${NAME} /threshold
RUN chmod -R 640 /threshold/*

# Legacy HashiCorp Boundary compatibility: /boundary -> /threshold and a
# "boundary" command alias (prints a deprecation notice on stderr).
RUN mkdir -p /usr/share/threshold && \
    cp /threshold/config.hcl /usr/share/threshold/config.hcl.default && \
    ln -s /threshold /boundary && \
    ln -s ${BIN_NAME} /bin/boundary

EXPOSE 9200 9201 9202
VOLUME /threshold/

COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

USER ${NAME}
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server", "-config", "/threshold/config.hcl"]